ci(.github/workflows): audit workflow self-references in paths (#25288)

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

Three workflows besides `deploy-docs.yaml`
([DOCS-124](https://linear.app/codercom/issue/DOCS-124),
[#25285](https://github.com/coder/coder/pull/25285)) self-reference in
their `paths:` triggers: `docker-base.yaml`, `docs-ci.yaml`,
`dogfood.yaml`. This was flagged during review of #25285
([DEREM-1](https://github.com/coder/coder/pull/25285#discussion_r3234975475))
as a bug class worth treating uniformly. This PR is the audit.

Each self-reference is either justified inline or removed:

* **`docker-base.yaml`** keeps the self-reference. It's PR-only and
gated by `push: ${{ github.event_name != 'pull_request' }}` on the
`depot/build-push-action`, so PRs build the base image without
publishing.
* **`docs-ci.yaml`** drops the self-reference. The `lint` and `fmt`
steps gate on `tj-actions/changed-files` matching `docs/**` or `**.md`,
so a workflow-only run no-ops. `actionlint` and `make lint/actions`
catch YAML problems before merge regardless.
* **`dogfood.yaml`** keeps the self-reference. PR runs build images
without pushing and run `terraform init` + `validate` only; pushes to
main retag rolling tags on `codercom/oss-dogfood`,
`oss-dogfood-vscode-coder`, and `oss-dogfood-nix`, plus `terraform
apply` against dev.coder.com which produces new `coderd_template`
versions with unchanged content. Idempotent and bounded.

Refs DOCS-121, DOCS-129.

<details>
<summary>Decision table</summary>

| Workflow | Self-ref location | Effect on workflow-only edit | Decision
|
|---|---|---|---|
| `deploy-docs.yaml` | push + workflow_dispatch | Destructive (DOCS-121)
| Removed in [#25285](https://github.com/coder/coder/pull/25285) |
| `docker-base.yaml` | PR-only | Build base image, never push | Keep
with inline comment |
| `docs-ci.yaml` | push + PR | Empty run; lint/fmt skipped by `if:` |
Remove (wasted runner minutes) |
| `dogfood.yaml` | push + PR | PR: build without push, terraform
validate. Main: retag rolling tags, terraform apply, new cosmetic
template versions | Keep with inline comment |

</details>

---
_Coder Agents on behalf of @nickvigilante._

This commit is contained in:

Nick Vigilante

2026-05-15 08:49:17 -04:00

committed by

GitHub

parent 81b6132e02

commit aa87d55a6d

3 changed files with 35 additions and 2 deletions

									
										.github/workflows/docker-base.yaml
									
		+7
		
												View File
												
				@@ -9,6 +9,13 @@ on:

				      - scripts/Dockerfile

				  pull_request:

				    # Self-reference on `pull_request` is intentional: a PR that edits this

				    # workflow runs the build to verify the YAML is well-formed and the

				    # base image still builds. Pushes are gated separately by

				    # `push: ${{ github.event_name != 'pull_request' }}` on the

				    # depot/build-push-action below, so a PR builds the image but never

				    # publishes it. See DOCS-129 for the broader workflow-self-reference

				    # audit.

				    paths:

				      - scripts/Dockerfile.base

				      - .github/workflows/docker-base.yaml